Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/discriminator/proxy.go

@@ -16,18 +16,18 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/routewatch"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// adminPrefix starts the path of each of discriminator's own endpoints. The app never
-// sees a path under it.
-const adminPrefix = "/_sww/"
+// ownEndpointPrefix starts the path of each of discriminator's own endpoints. The app
+// never sees a path under it.
+const ownEndpointPrefix = "/_sww/"
 
 // HealthPath is the health endpoint of discriminator and of rproxy, which the
 // container's health check asks.
@@ -65,7 +65,7 @@ type Params struct {
 	LookupFile *lookup.File
 	// CoreRuleSet is what NewCoreRuleSet returns: what inspects requests
 	// while SWW_WAF_MODE is not off, and nil while it is.
-	CoreRuleSet *waf.CoreRuleSet
+	CoreRuleSet *coreruleset.CoreRuleSet
 	// Now tells the time by which requests are counted for the rate
 	// limits, bans are made and run out, and GeoJS's answers are kept,
 	// normally time.Now in UTC, the time the state files give.
@@ -129,7 +129,7 @@ func newHandler(params Params) *handler {
 			BytesPerHour:   params.Config.BytesLimitPerHour,
 			BytesPerDay:    params.Config.BytesLimitPerDay,
 		}, params.Config.MaxTrackedClients),
-		ledger: bans.New(bans.Rules{
+		ledger: bans.New(bans.Params{
 			LimitBanDuration:     params.Config.LimitBanDuration,
 			LimitBanRepeatWindow: params.Config.LimitBanRepeatWindow,
 			MaxBanDuration:       params.Config.MaxBanDuration,
@@ -224,15 +224,15 @@ func newReputation(
 // SWW_CORE_RULE_SET_EXCLUSIONS_FILE, or nil while SWW_WAF_MODE is off. It
 // reads at most QuestionBodyMaxBytes less one byte: a question's body of
 // QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
-// JSON or XML body over its limit. An exclusions file that waf.New refuses is
+// JSON or XML body over its limit. An exclusions file that coreruleset.New refuses is
 // an error in every mode. While the mode is off, a set file is loaded with the
 // Core Rule Set only to check it.
-func NewCoreRuleSet(cfg *config.Config) (*waf.CoreRuleSet, error) {
+func NewCoreRuleSet(cfg *config.Config) (*coreruleset.CoreRuleSet, error) {
 	if cfg.WAFMode == config.WAFModeOff && cfg.CoreRuleSetExclusionsFile == "" {
 		return nil, nil //nolint:nilnil // off is no Core Rule Set, and no error
 	}
 
-	coreRuleSet, err := waf.New(waf.Params{
+	coreRuleSet, err := coreruleset.New(coreruleset.Params{
 		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
 		BodyLimit:      min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
 		ExclusionsFile: cfg.CoreRuleSetExclusionsFile,
@@ -266,7 +266,7 @@ type handler struct {
 	abuseIPDB   *reputation.AbuseIPDB
 	routeWatch  *routewatch.Client
 	rules       *rules.Files
-	coreRuleSet *waf.CoreRuleSet
+	coreRuleSet *coreruleset.CoreRuleSet
 	alerts      *alerts.Queue
 	// awaitingReport holds the decision on each answered question by its id
 	// until its report comes, and nil for a question still being handled.